{"record":{"id":"015548821acab383","repo":"hashicorp/nomad","slug":"failed-to-generate-envoy-bootstrap-config-w","errorCode":null,"errorMessage":"failed to generate envoy bootstrap config: %w","messagePattern":"failed to generate envoy bootstrap config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/taskrunner/envoy_bootstrap_hook.go","lineNumber":307,"sourceCode":"\t// Set runtime environment variables for the envoy admin and ready listeners.\n\tresp.Env = map[string]string{\n\t\thelper.CleanEnvVar(envoyAdminBindEnvPrefix+serviceName, '_'): envoyAdminBind,\n\t\thelper.CleanEnvVar(envoyReadyBindEnvPrefix+serviceName, '_'): envoyReadyBind,\n\t}\n\n\t// Envoy bootstrap configuration may contain a Consul token, so write\n\t// it to the secrets directory like Vault tokens.\n\tbootstrapFilePath := filepath.Join(req.TaskDir.SecretsDir, \"envoy_bootstrap.json\")\n\n\t// Write everything related to the command to enable debugging\n\tbootstrapStderrPath := filepath.Join(req.TaskDir.LogDir, \"envoy_bootstrap.stderr.0\")\n\tbootstrapEnvPath := filepath.Join(req.TaskDir.SecretsDir, \".envoy_bootstrap.env\")\n\tbootstrapCmdPath := filepath.Join(req.TaskDir.SecretsDir, \".envoy_bootstrap.cmd\")\n\n\tsiToken, err := h.maybeLoadSIToken(req.Task.Name, req.TaskDir.SecretsDir)\n\tif err != nil {\n\t\th.logger.Error(\"failed to generate envoy bootstrap config\", \"sidecar_for\", service.Name)\n\t\treturn fmt.Errorf(\"failed to generate envoy bootstrap config: %w\", err)\n\t}\n\th.logger.Debug(\"check for SI token for task\", \"task\", req.Task.Name, \"exists\", siToken != \"\")\n\n\tproxyID := h.proxyServiceID(h.alloc.TaskGroup, service)\n\tbootstrap := h.newEnvoyBootstrapArgs(service, grpcAddr, envoyAdminBind, envoyReadyBind, siToken, bootstrapFilePath, proxyID)\n\n\t// Create command line arguments\n\tbootstrapArgs := bootstrap.args()\n\n\t// Write args to file for debugging\n\targsFile, err := os.Create(bootstrapCmdPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to write bootstrap command line: %w\", err)\n\t}\n\tdefer argsFile.Close()\n\tif _, err := io.WriteString(argsFile, strings.Join(bootstrapArgs, \" \")+\"\\n\"); err != nil {\n\t\treturn fmt.Errorf(\"failed to encode bootstrap command line: %w\", err)\n\t}","sourceCodeStart":289,"sourceCodeEnd":325,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/taskrunner/envoy_bootstrap_hook.go#L289-L325","documentation":"The envoy_bootstrap_hook generates the Envoy bootstrap configuration for a Connect sidecar/gateway during Prestart. It first loads the Consul SI (service identity) token with maybeLoadSIToken; if that fails, it logs an error and returns 'failed to generate envoy bootstrap config' wrapping the cause. Without the SI token the bootstrap file cannot be generated correctly.","triggerScenarios":"maybeLoadSIToken returns an error: the consul token file is missing from the task's SecretsDir when Connect requires it, unreadable permissions, or an error reading/writing the token path inside the secrets directory.","commonSituations":"Task running Consul Connect services without the Consul SI identity/Token configured; Consul version too old to support SI tokens; secrets dir not mounted or cleaned before the hook runs; Consul ACL setup incomplete.","solutions":["Check the wrapped error to see if the token file is missing vs unreadable","Ensure the task has a Consul service identity (consul.token / workload identity) configured","Verify Consul is >= 1.8 and ACLs are enabled/compatible with SI token flow","Confirm the task's SecretsDir exists and is populated before Prestart completes","Retry the allocation; the hook regenerates the bootstrap on restart"],"exampleFix":"// before: no identity configured for the connect service\nservice { name = \"api\" connect { sidecar_service {} } } // missing token\n// after: ensure Consul SI token is provisioned to the task\n// enable Consul SI token injection (Consul >=1.8, acls enabled) or supply\n// identity { kind = \"consul\"; name = \"api\" } in the task group","handlingStrategy":"validation","validationCode":"// before Prestart, verify the SI token artifact is present\nif _, err := os.Stat(filepath.Join(secretsDir, consulTokenFilename)); err != nil {\n    return fmt.Errorf(\"consul SI token missing for envoy bootstrap: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := hook.Prestart(req); err != nil {\n    if strings.Contains(err.Error(), \"failed to generate envoy bootstrap config\") {\n        log.Printf(\"envoy bootstrap failed: %v; check Consul SI token provisioning\", err)\n    }\n    return err\n}","preventionTips":["Provision Consul SI tokens (identity blocks) for every Connect task","Run Consul >= 1.8 with ACLs enabled for the SI token flow","Verify SecretsDir is mounted and populated before envoy hooks run","Test Connect services after Consul/Consul upgrades"],"tags":["consul","consul-connect","envoy","nomad"],"backgroundTag":"missing-si-token","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}